# Systemctl start logstash does nothing **URL:** \ **Category:** Logstash\ **Created:** [December 2, 2021, 7:06pm UTC](https://discuss.elastic.co/t/systemctl-start-logstash-does-nothing/290814 "2021-12-02T19:06:32Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![EvanGertis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/evangertis/32/85191_2.png) [@EvanGertis](https://discuss.elastic.co/u/EvanGertis)\ **Post date:** [December 2, 2021, 7:06pm UTC](https://discuss.elastic.co/t/systemctl-start-logstash-does-nothing/290814/1 "2021-12-02T19:06:32Z")
I am working on pulling changes onto a few logstash boxes. The issue is when I run the command ```auto systemctl start logstash ``` I get nothing back. Expected: logstash starts with a verbose output. Actual: ```auto ``` Any help with this issue would be greatly appreciated. Thank you. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [December 2, 2021, 7:14pm UTC](https://discuss.elastic.co/t/systemctl-start-logstash-does-nothing/290814/2 "2021-12-02T19:14:55Z")
> [@EvanGertis](#): > > I get nothing back. That is normal. You can check the systemd journal using ``` journalctl -u logstash ``` ---
**Author:** ![EvanGertis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/evangertis/32/85191_2.png) [@EvanGertis](https://discuss.elastic.co/u/EvanGertis)\ **Post date:** [December 2, 2021, 7:17pm UTC](https://discuss.elastic.co/t/systemctl-start-logstash-does-nothing/290814/3 "2021-12-02T19:17:26Z")
I get back ```auto journalctl -u logstash -- Logs begin at Fri 2021-11-05 19:37:17 UTC, end at Thu 2021-12-02 19:16:19 UTC. -- Nov 30 13:51:52 ip-10-12-128-146.ec2.internal logstash[16366]: [2021-11-30T13:51:52,167][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"zitilogs-2021> Nov 30 13:51:52 ip-10-12-128-146.ec2.internal logstash[16366]: [2021-11-30T13:51:52,167][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"zitilogs-2021> ``` I'd like to make sure that the changes that I've have taken place. ---
**Author:** ![EvanGertis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/evangertis/32/85191_2.png) [@EvanGertis](https://discuss.elastic.co/u/EvanGertis)\ **Post date:** [December 2, 2021, 7:20pm UTC](https://discuss.elastic.co/t/systemctl-start-logstash-does-nothing/290814/4 "2021-12-02T19:20:16Z")
The logs also stopped flowing to elastic. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [December 2, 2021, 7:22pm UTC](https://discuss.elastic.co/t/systemctl-start-logstash-does-nothing/290814/5 "2021-12-02T19:22:44Z")
The other place to check is /var/log/logstash. ---
**Author:** ![EvanGertis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/evangertis/32/85191_2.png) [@EvanGertis](https://discuss.elastic.co/u/EvanGertis)\ **Post date:** [December 2, 2021, 7:25pm UTC](https://discuss.elastic.co/t/systemctl-start-logstash-does-nothing/290814/6 "2021-12-02T19:25:12Z")
I'm getting ```auto [FATAL] 2021-12-02 19:24:16.596 [LogStash::Runner] runner - The given configuration is invalid. Reason: Cannot evaluate `${LOGSTASH_PASSWORD}`. Replacement variable `LOGSTASH_PASSWORD` is not defined in a Logstash secret store or as an Environment entry and there is no default value given. ``` ---
**Author:** ![EvanGertis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/evangertis/32/85191_2.png) [@EvanGertis](https://discuss.elastic.co/u/EvanGertis)\ **Post date:** [December 2, 2021, 7:36pm UTC](https://discuss.elastic.co/t/systemctl-start-logstash-does-nothing/290814/7 "2021-12-02T19:36:57Z")
I've updated the env vars and I ran ```auto bin/logstash --config.test_and_exit -f /etc/logstash/conf.d/ WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console [WARN] 2021-12-02 19:34:51.986 [LogStash::Runner] multilocal - Ignoring the 'pipelines.yml' file because modules or command line options are specified [INFO] 2021-12-02 19:35:17.674 [LogStash::Runner] cloudwatchlogs - Using version 0.1.x codec plugin 'cloudwatch_logs'. This plugin isn't well supported by the community and likely has no maintainer. Configuration OK ``` But now I get ```auto # systemctl status logstash ● logstash.service - logstash Loaded: loaded (/etc/systemd/system/logstash.service; enabled; vendor preset: disabled) Active: deactivating (stop-sigterm) since Thu 2021-12-02 16:15:29 UTC; 3h 22min ago Main PID: 16366 (java) Tasks: 35 (limit: 22600) Memory: 1.6G CGroup: /system.slice/logstash.service ``` I was able to get through this by finally running ```auto bin/logstash -f /etc/logstash/conf.d/ WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console [WARN] 2021-12-02 19:54:46.708 [LogStash::Runner] multilocal - Ignoring the 'pipelines.yml' file because modules or command line options are specified [INFO] 2021-12-02 19:54:46.726 [LogStash::Runner] runner - Starting Logstash {"logstash.version"=>"6.8.20"} ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 30, 2021, 7:37pm UTC](https://discuss.elastic.co/t/systemctl-start-logstash-does-nothing/290814/8 "2021-12-30T19:37:20Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.